CVE-2025-39720

ksmbd: fix refcount leak causing resource not released

State: Published
Severity: 7.5 High
Published: Sep 5, 2025
Updated: Oct 30, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix refcount leak causing resource not released

When ksmbd_conn_releasing(opinfo->conn) returns true,the refcount was not decremented properly, causing a refcount leak that prevents the count from reaching zero and the memory from being released.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	0626e6641f6b467447c81dd7678a69c66f7746cf to before 263680d314eaaa27334f486d86c9fe7d19f50c8aAffected 0626e6641f6b467447c81dd7678a69c66f7746cf to before a1d2bab4d53368a526c97aba92671dd71814f95aAffected 0626e6641f6b467447c81dd7678a69c66f7746cf to before 36e010bb865fbaa1202fe9bcce3fd486d6db7606Affected 0626e6641f6b467447c81dd7678a69c66f7746cf to before 9a7abce6e8c0e2145b346a6d4abf0d9655e9b0e8Affected 0626e6641f6b467447c81dd7678a69c66f7746cf to before 89bb430f621124af39bb31763c4a8b504c9651e2Affected
LinuxLinux	5.15Affected before 5.15Not affected 6.1.191 through 6.1.Not affected 6.6.103 through 6.6.Not affected 6.12.44 through 6.12.Not affected 6.16.4 through 6.16.Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

0626e6641f6b467447c81dd7678a69c66f7746cf to before 263680d314eaaa27334f486d86c9fe7d19f50c8aAffected
0626e6641f6b467447c81dd7678a69c66f7746cf to before a1d2bab4d53368a526c97aba92671dd71814f95aAffected
0626e6641f6b467447c81dd7678a69c66f7746cf to before 36e010bb865fbaa1202fe9bcce3fd486d6db7606Affected
0626e6641f6b467447c81dd7678a69c66f7746cf to before 9a7abce6e8c0e2145b346a6d4abf0d9655e9b0e8Affected
0626e6641f6b467447c81dd7678a69c66f7746cf to before 89bb430f621124af39bb31763c4a8b504c9651e2Affected

LinuxLinux

5.15Affected
before 5.15Not affected
6.1.191 through 6.1.*Not affected
6.6.103 through 6.6.*Not affected
6.12.44 through 6.12.*Not affected
6.16.4 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.